Dynamickit For Elementor
Monthly
Password reset link host poisoning in DynamicKit for Elementor WordPress plugin (versions before 1.0.3) enables unauthenticated attackers to redirect victims' password reset emails to an attacker-controlled domain, carrying a valid reset key issued by the legitimate WordPress site. When the victim clicks the link, the attacker captures the reset token and achieves full account takeover. A publicly available exploit exists via WPScan, though EPSS sits at just 0.14% (4th percentile), indicating limited observed exploitation despite the severity rating and POC availability.
Password reset link host poisoning in DynamicKit for Elementor WordPress plugin (versions before 1.0.3) enables unauthenticated attackers to redirect victims' password reset emails to an attacker-controlled domain, carrying a valid reset key issued by the legitimate WordPress site. When the victim clicks the link, the attacker captures the reset token and achieves full account takeover. A publicly available exploit exists via WPScan, though EPSS sits at just 0.14% (4th percentile), indicating limited observed exploitation despite the severity rating and POC availability.